Proactive PCAP

[New2Meraki]

Hi all -

I recently started at a company that uses Meraki so I'm on a learning curve.  One of the cool things I noticed is that Meraki wireless can now automatically capture packets if a client has issues joining wifi (or roaming, believe).  But there's a part that doesn't pass the sniff test and I'm not clear what's going on. 

1) It's not enabled by default.

2) Once you enable it, you choose how broadly to turn it on (just this AP, this entire network, etc).

I can't think of even a single scenario where you wouldn't want this working on every single AP, by default.  There's obviously a reason Meraki doesn't turn this on by default and perhaps the same reason it isn't applied to all AP's by default.

What's the downside to turning this on everywhere?  Why would you ever choose to turn it on only in some places, but intentionally remain in the dark for wireless issues in other parts?  What's the tradeoff that's not mentioned in the documentation?

[New2Meraki]

Interesting, thanks for your thoughts! I'd be very interested in an actual response from PM as the guesses still don't provide a reasonable answer (IMO).  I hope this comes across as intended, which is genuinely just trying to understand. 

There's a feature that, if it works as advertised, any customer outside a true mom-and-pop would want turned on everywhere, by default.  But it's not, and Meraki went to a lot of trouble to build a workflow that requires you to specify if it should be on at all and, if so, where exactly you want it on.  You provided 3 reasons, which I'll restate below to see if I'm understanding correctly.

- First reason is because it's new, quite probably buggy, and could cause real production impact.  Hence many customers shouldn't turn it on outside a lab.  If true, this should be spelled out more clearly in the documentation.  Like a VERY clear warning that turning this on could cause serious production impact.

- Second, it will require an advanced license eventually and not many people have that.  But this would only make sense if Meraki will auto-charge those who don't have a license once it becomes required.  I can't imagine that would be true but, if so, it's ridiculous that it isn't spelled out clearly.

- Third reason is that some customers don't care if wireless is working well or not, so not turning it on saves Meraki on storage.  This seems like a major reach (no offense intended whatsoever)...

For the 3rd reason to be true, Meraki would have to genuinely believe that a significant number of their customers are so far down on the SMB spectrum that they literally just do not care if wifi is working or not.  And if it isn't working, they simply do not want to have the evidence to troubleshoot and remediate - even if they gain absolutely nothing by not having it enabled.  I don't mean this as disrespectful but this would seem like an awful assumption to actually believe your customers are buying your product, deploying it, and then just stop caring if it works or not.

Again, I really hope this comes across ok.  It's just fishy that this amazing new feature is released that, if it works as advertised, any reasonable customer would want turned on everywhere - by default.  But it's not and there must be an extremely compelling reason that Meraki made this decision.  There's something we're not being told in the documentation and I'm not sure why 😕

[cmr]

I tested it on a small network and it captured a few hundred sessions in a couple of days.  It will only let you store a certain amount and in any reasonable size network you would end up with many thousands of captures in a day.  This is why I think you are only meant to enable it for particular troubleshooting.

[cmr]

I've also noticed that it now needs the advantage/advanced license, which I don't remember being the case when it was first available? 

If you have that then you can store up to 4GB of captures in the cloud with proactive capturing.

As PDL allows you to apply an advantage license to individual APs, with the rest left at Enterprise, you could just enable it on those.

[Ryan_Miles]

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Packet_Capture_Overvi...

Same as MS130 adaptive policy in that during early access phase license enforcement is not enabled.

[TyShawn]

Let's make this phase a long as possible 🙂 we are in noooooooo rush ;).

[TyShawn]

Yeah they changed it at some point I recall seeing the advance warning when I noticed the feature. 

[New2Meraki]

Right, but using this method significantly weakens the effectiveness.  If this feature actually works then you end up with a network you can troubleshoot with proactive notification in some places but not in others.  That sucks. 

[New2Meraki]

WHOA.  If accurate, this makes the feature MUCH less compelling.  The entire point of Proactive Pcap is to capture issues the first time they happen, and provide a dynamic pcap for the evidence.  If you only turn it on to troubleshoot once there's an issue then you've already lost the entire "proactive" part.